ADFS Redundancy for Office365

[Blue_Cookeh]

Hi guys,

 

Just wondering who here has setup ADFS for Office365? It's quite tempting to set up in our school, DirSync seems to be a bit naff once you get into the nitty gritty of it.

 

I've been looking at it and my main concern is setting up redundancy. We have two internet connections - fine, I could stick it on two different servers - fine, but have you guys gone as far as to make sure there are redundant paths across your network for this for example?

 

It seems a bit overkill for our primary but on the other hand DirSync seems to be too unreliable, or easy to break.

Edited April 17, 2015 by Blue_Cookeh

[synaesthesia]

Can't really see the point of using ADFS, certainly not in a primary. We have no problems with dirsync for a large secondary, would therefore suggest it may be better to get to the root of your problems otherwise you may end up causing further grief down the line.

[Blue_Cookeh]

That's what I'm thinking... KISS might apply here but I'm just spitballing for the moment!

[Michael]

My view is ADFS or similar involves a lot of configuring/setup up to make it work - yet it's just for one product - Office 365. Chances are your school subscribe to other services which each require their own login anyway. If it solved authentication across many products, it would certainly be worth more the effort.

 

Secondly, once users grasp they can set it up on their Smartphone or Tablet and then forget about it - ADFS then becomes irrelevant really. Most users are quite happy with the routine of signing into Windows and then Office 365 via OWA - then that's it, they're good for the day unless they close their browser window. The best part is no redundancy is needed, so it's one less thing to worry about.

[Firefox]

We have 2 servers in an ADFS farm that then go though a 2 server ADFS proxy farm. Our only issue at the moment is it's not Geo Redundant so something that needs to be looked at for the future. We use this WITH Dirsync (which works great, and is easy to use, especially if you have FIM experience).

 

Admittedly we're likely working with a lot larger user base then yourselves, so ADFS is probably overkill

[mbedford]

I set up two Office 365 solutions (staff and student) with ADFS on Server 2012R2 in under a day, It's easy.

 

DirSync was terrible, knock it on the head and use a combination of PowerShell and task scheduler to compare your onprem AD to Office365 each night and create the missing accounts. Can also apply licences at the same time. Let ADFS worry about the authentication and voilla you are done.

 

Check out this guide for ADFS installation How To Install ADFS 2012 R2 For Office 365 - 250 Hello - Site Home - TechNet Blogs

 

For redundancy, what environment are you in?? are your servers virtual or physical. Personally i would use Hyper-V and if the hardware was available replicate the ADFS server across two hosts. Obviously this depends on if you have the hardware available, but for mission critical servers (DC's, ADFS, VLE....) its gotta be worth it for the piece of mind alone, if the hardware falls over, click go on the replica and you are back up with minimal downtime. YOu could even setup automatic replication and failover but that can be a little too sensitive to network issues and you may find that you are spending more time chasing your VM's from one host to the other as they have failed over for no reason. But on the other hand, if both hosts are equal, then whats the harm as long as the VM's are running somewhere.

 

If you need any help, give me a shout.

 

Mike

Edited April 20, 2015 by mbedford

[psydii]

While thinking about something else, I had what could be a terrible idea:

 

Spin up a DC as a VM in Azure. Install all the ADFS Stuff as VMs in Azure, then configure AzureAD to use these VMs. Now it never matters if you site link goes down as all of your Authentication happens inside the Azure infrastructure!

 

I haven't researched this. There may be sound reasons why this isn't a good idea.

Edited April 20, 2015 by psydii

[Firefox]

I set up two Office 365 solutions (staff and student) with ADFS on Server 2012R2 in under a day, It's easy.

 

DirSync was terrible, knock it on the head and use a combination of PowerShell and task scheduler to compare your onprem AD to Office365 each night and create the missing accounts. Can also apply licences at the same time. Let ADFS worry about the authentication and voilla you are done.

 

Check out this guide for ADFS installation How To Install ADFS 2012 R2 For Office 365 - 250 Hello - Site Home - TechNet Blogs

 

For redundancy, what environment are you in?? are your servers virtual or physical. Personally i would use Hyper-V and if the hardware was available replicate the ADFS server across two hosts. Obviously this depends on if you have the hardware available, but for mission critical servers (DC's, ADFS, VLE....) its gotta be worth it for the piece of mind alone, if the hardware falls over, click go on the replica and you are back up with minimal downtime. YOu could even setup automatic replication and failover but that can be a little too sensitive to network issues and you may find that you are spending more time chasing your VM's from one host to the other as they have failed over for no reason. But on the other hand, if both hosts are equal, then whats the harm as long as the VM's are running somewhere.

 

If you need any help, give me a shout.

 

Mike

 

If you don't mind me asking, what problems did you have with DirSync? we have it running and it just works. The only tweak it needed from the OOB setup is what OU's to target.

 

 

@psydii it sounds good on paper, except you'd likely have a better up time of a DC on prem then in Azure. I for one am not a fan of the fact there is no console view in Azure, so if the server was experiencing problems, you're expected to download the VM and fix it on prem.

[mbedford]

I would love to be able to give you some details on the issues I was experiencing. But unfortunately there in lies the problem. It would just fail, seemingly randomly with non nonsensical error messages like "Stopped-Server-Down" which on contacting MS Support, could mean one of a hundred different things. Its like the team developing it just did one huge try\catch exception block in the code and "Stopped-Server-Down" was the result. I would spend hours setting it up and it would work great for a week or a month and then for no reason, broken. MS Support solution every time, re install Windows Azure Active Directory and Reconfigure DirSync from scratch. It was just an accident waiting to happen, I felt like the whole process required far too much hand holding and I was never confident that it was working as it was supposed to.

 

I ended up not been 100% (or anywhere near that) certain about which accounts had been provisioned offsite, who had correct details etc.... With 30000+ student accounts (including alumni) I couldn't manually reconcile all of the accounts from the web interface. So in the end I just bit the bullet. Worked out how to convert an active directory user account GUID to an immutable ID (the actual ID that Office 365 uses to match users, why it cant use any of the other already in place unique ID's is beyond me but there we go) and just got PowerShell to run through every account that was made in the last 7 days every evening. Yes this means that I am probably checking 100+ accounts over and over again until 7 days pass just to get the 2 or 3 new ones, but I am 100% certain that the accounts are provisioned.

 

Two benefits from this for me really.

1. I know exactly how the system works, its targeted based on what I have written in the PowerShell script.

2. I can write everything to a log file, so its far easier to see what has gone wrong and at least have an idea of where to go to fix it. Rather than "Stopped-Server-Down"

Edited April 21, 2015 by mbedford